Privacy policy

1. Who is responsible

Cedar Digital is the responsible party for personal information processed through Dreamer under the Protection of Personal Information Act, 2013 (POPIA). Questions and requests go to support@dreamer.money.

2. What we collect, and why

To open and run your account

• Your name, email address and mobile number, to create the account and send one-time sign-in codes.
• Your South African identity number and a selfie, to verify your identity as the law requires before you invest. The identity number is encrypted the moment you submit it; we keep a one-way hash and the last four digits for matching and display, and the full number is never shown back to anyone.
• Your residential address, for the same verification.

When you join the waitlist or write to us

• The email address, and the name if you give one, that you enter on the waitlist form on this site. We use it only to tell you when Dreamer opens, and remove it whenever you ask.
• The name, email address and message you send through the contact form, used only to answer you.

To calculate round-ups

• The transactions on the bank account you link: date, merchant, amount and type. They are received, read-only, through a licensed open-banking provider under a consent you can withdraw at any time. We never receive or store your bank username or password.

To invest and pay

• The details of your Dream Account, dreams, fund choices, contributions, balances and withdrawals.
• The bank account you withdraw to, which must be in your own name.
• Card payments for membership and boosts are taken on a hosted payment page run by a payment provider; card numbers never reach Dreamer’s servers. We keep a token and the last four digits.

To keep the app working

• Device type, app version, a push-notification token if you enable notifications, and error logs with a support code.

This website itself sets no tracking cookies and runs no advertising or analytics scripts.

3. Who we share it with

• Our licensed investment partner and the custodian, to open and operate the investment account in your name and to place your contributions in the funds you chose.
• The open-banking provider, to establish and maintain the read-only bank link you consented to.
• The identity-verification provider, to check your identity number and selfie against official records.
• The payment provider, to process card payments.
• SARS and other authorities, where the law requires it, including tax-free savings account reporting.
• Service providers who host our systems, all under contract and only for the purposes above.

We do not sell personal information and do not share it for marketing.

4. Where it is kept

Data is stored on servers that may be located outside South Africa, with providers bound by contract to protect it at least to the standard POPIA requires. Sensitive fields, including identity documents, are encrypted at rest with AES-256.

5. How long

For as long as you have an account, and afterwards for as long as financial-services and tax law require records to be kept (typically five years from the end of the relationship). Transaction data from a disconnected bank account is no longer received; historical round-up records remain part of your investment history.

6. Your rights

• To know what we hold about you, and to receive a copy.
• To have inaccurate information corrected.
• To withdraw consent to the bank link, at any time, in the app.
• To object to processing, and to ask for deletion where the law allows.
• To complain to the Information Regulator (South Africa) if you are not satisfied with our response.

Write to support@dreamer.money. We respond within a reasonable time and never later than the law requires.

7. Children

Dreamer is for adults. We do not knowingly collect information from anyone under 18.

8. Changes

The version and date appear at the top of this page. Material changes are announced in the app before they take effect.